Re:A cartoon intro to DNS over HTTPS (2018)
by JoshTriplett on Sunday October 20, 2019 @05:43AM
(#21303151)
There's a huge additional authoritarian step required to push MITM of all traffic. You cannot do that without people at the endpoints noticing. DNS-based "filtering" can pass unnoticed by many people; full MITM of all traffic cannot.
When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them.
When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people.
DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM.
And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.
When a regime does something that only a small subset of people notice, it's easier to suppress that small subset of people, with a combination of PR and just ignoring them.
When a regime does something that everyone notices, it has to be prepared to be visibly acting against a large fraction of its people.
DoH won't stop a sufficiently determined regime from attempting to control the Internet, but it will stop less determined regimes from doing so quietly and getting away with it with minimal resistance, and not every regime is prepared for the implications and backlash of implementing country-wide MITM.
And on a more local scale, DoH also increases friction towards smaller entities trying to quietly control access to the Internet, such as ISPs or random wifi hotspots.